Breadcrumb

What Is Authorised Push Payment Fraud?

Written by

The GoCardless content team comprises a group of subject-matter experts in multiple fields from across GoCardless. The authors and reviewers work in the sales, marketing, legal, and finance departments. All have in-depth knowledge and experience in various aspects of payment scheme technology and the operating rules applicable to each. The team holds expertise in the well-established payment schemes such as UK Direct Debit, the European SEPA scheme, and the US ACH scheme, as well as in schemes operating in Scandinavia, Australia, and New Zealand. See full bio

Last editedNov 20213 min read

Have you ever unwittingly transferred money to a stranger’s account? If so, you may be a victim of authorised push payment fraud. You wouldn’t be alone – unfortunately, push payment fraud is all too common in the UK. Keep reading to learn how this type of scam works and what steps you can take to protect yourself.

Understanding authorised push payment fraud

Also called a bank transfer scam, authorised push payment fraud occurs when consumers transfer money from their bank accounts to a scammer’s account. For example, a fraudster might pretend to be part of your mobile phone provider’s security team. They’ll tell you to transfer funds to a secure account to pay your bill and avoid late fees. These real-time payments are technically authorised by the victim of the scam, which can make it difficult to recover the money.

How does push payment fraud work?

Why would you transfer a payment to the bank account of someone you don’t know? Push payment fraud uses just enough personalised details to convince you that the scammer is legitimate. Fraudsters arm themselves with personal information to be convincing. They might access their mark’s hacked email account or bank account details, taking note of types and timings of payments that the consumer usually makes.

For example, a common push payment scam takes place the day of a property purchase. The buyer would already be expecting to pay a large settlement fee to their solicitor on completion day, so the scammer takes advantage of that knowledge without raising any red flags.

Types of push payment scams

In addition to the property scheme mentioned above, here are a few additional examples of authorised push payment fraud:

Invoices sent by scammers designed to replicate a trusted source
The scammer pretends to be a contractor you’ve hired to carry out work
Bank account takeovers using hacked bank account numbers and passwords

Through hacked emails, the fraudster provides just enough details to make their requests for payment seem legitimate. When you submit payment, it goes directly into their bank account without your notice.

How to get an authorised push payment refund

Until recently, push payment scams were successful because consumers had little recourse to recover their money. Fortunately, it’s now easier to get an authorised push payment refund thanks to the voluntary authorised push payment scam code.

Step 1: Contact your bank.

As with any scam, the very first thing to do if you suspect fraud is to call your card provider or bank. If you work quickly enough, the bank may be able to stop the transfer or recover the money.

Step 2: Contact the recipient’s bank.

After you’ve contacted your own bank, you should get on the phone with the recipient’s bank. You’ll need to know the bank account number and any other identifying details you can find.

Step 3: Escalate the issue.

If you’ve had no luck getting a refund from your bank and feel you’ve followed all the steps correctly, you can make a formal complaint with your bank. If this doesn’t work, escalate the issue with the Financial Ombudsman.

Understanding the authorised push payment scam code

Before 2019, getting an authorised push payment refund was next to impossible due to the nature of this real-time payment scam. However, the authorised push payment scam code was launched on 28 May 2019. This outlines the steps that banks must take to protect customers, up to and including reimbursement for fraud. It’s important to note that the Code is voluntary, and banks aren’t legally required to follow it. The Code only covers domestic transfers between UK accounts. If you’re not sure, check the Payment Service Regulator website or speak to your bank’s customer service.

Bank responsibilities: If your bank follows the push payment code, it’s required to reimburse victims of push payment scams. It’s also required to identify higher risk payments, provide warnings of unusual activity, and educate consumers about authorised push payment scams.
Consumer responsibilities: In return, consumers must follow some steps of their own. This includes heeding bank warnings and following instructions given. Consumers also won’t be able to receive authorised push payment refunds unless they made the payment believing it was genuine.

Of course, it’s better to prevent bank transfer fraud before it happens if possible. The first step is awareness of scams involving push payments. Because most fraud involves hacked personal details, it’s always a good idea to change your passwords regularly.

Finally, think twice before sending any payment, even if it’s someone you’ve paid in the past. If something seems off about an email or text, it’s worth a quick Google to find out if the company is legitimate.

We can help

GoCardless helps you automate payment collection, cutting down on the amount of admin your team needs to deal with when chasing invoices. Find out how GoCardless can help you with ad hoc payments or recurring payments.